5 ms·

A Spamhaus DNSBL alone drops 99% of spam with almost no FPs. Add DROP, fullbogons, and greylisting to increase the percentage further. None of these methods re

by Panino 11y ago

A Spamhaus DNSBL alone drops 99% of spam with almost no FPs. Add DROP, fullbogons, and greylisting to increase the percentage further. None of these methods read the message body, and there are plenty of other options as well. I self-host and receive about 5 spam messages per year, all without looking at the message body.

ryanlol 11y ago
I'm not sure if you know how spamhaus DNSBL works, "no FPs" is ridiculously far from the truth. They make it near impossible for bigger hosts not to get blacklisted unless they fully comply with spamhaus.
- DanBC 11y ago
  Do you have any cites for this? Everything I've seen suggests that Zen has a very low false positive rate. That's the point of Zan - block a decent amount of spam and no real email so that your slower better filters can work.
  - ryanlol 11y ago
    Spamhaus has a history of extorting larger ISPs into dropping their customers instead of just blocking said customer. https://www.virusbtn.com/blog/2011/10_13.xml https://www.virusbtn.com/blog/2011/10_13.xml It's worth noting that spamhaus had no real reason to do this as they had already blocked the hosting company a2b was providing bandwidth to, so blocking all of a2b didn't actually stop any more spam. Zen is far far from not blocking any real email, they regularly block large ISPs that refuse too indiscriminately drop customers on their request.
    - DanBC 11y ago
      From your link: > Update: Spamhaus has now commented on the case in a blog post, explaining how Cyberbunker (also known as CB3ROB) has been involved in hosting malware and phishing sites. Ironically, this very week Spamhaus has been working with the Dutch hi-tech crime unit to investigate the criminal activity hosted by Cyberbunker and routed by A2B. This is really your example of false positive blocking?
      - ryanlol 11y ago
        A2B was routing CB, CB was not using A2Bs IP space. Spam was not coming from A2B. A2Bs IP space was blocked by Spamhaus to force them to drop CB. What exactly justified blocking A2Bs IP space here? Spamhaus is a really shady organization with a history of unethical behavior, look up the nic.at fiasco as another example... Or just ask anyone who works in hosting.
        DanBC 11y ago
        > Per Spamhaus policy, on October 6th, after notifying A2B several times since June without results, an SBL listing which A2B had been ignoring was escalated to the SBL's "providing a spam support service" category and increased to include one of A2B's IP ranges. The escalated SBL record SBL112638 listed 178.249.152.0/21 for providing routing "knowingly and for profit" to a rogue host known as "CB3ROB" or "Cyberbunker", an outfit which Spamhaus has long seen involved in hosting cybercrime and spam outfits. SBL listings of CB3ROB had been mounting steadily during 2011 for hosting malware, phishing and websites selling fraudulent goods advertised via spam. CB3ROB had announced that it would not terminate customers due to spam listings - an announcement which sent a golden invitation to even more spam and crime customers to the point where all of CB3ROB was placed on the Spamhaus DROP ("Don't Route Or Peer") list at the beginning of October. That's exactly what people want from something like the SBL, which is why it's used by so many people. Your reference to nic.at is weird - again they were providing services to a bunch of criminals. When complaining about false positives it'd be really helpful if you could point to people who aren't fucking scumbags who are getting blocked.

by Panino 11y ago

ryanlol 11y ago

I'm not sure if you know how spamhaus DNSBL works, "no FPs" is ridiculously far from the truth. They make it near impossible for bigger hosts not to get blacklisted unless they fully comply with spamhaus.

DanBC 11y ago
Do you have any cites for this? Everything I've seen suggests that Zen has a very low false positive rate. That's the point of Zan - block a decent amount of spam and no real email so that your slower better filters can work.
- ryanlol 11y ago
  Spamhaus has a history of extorting larger ISPs into dropping their customers instead of just blocking said customer. https://www.virusbtn.com/blog/2011/10_13.xml https://www.virusbtn.com/blog/2011/10_13.xml It's worth noting that spamhaus had no real reason to do this as they had already blocked the hosting company a2b was providing bandwidth to, so blocking all of a2b didn't actually stop any more spam. Zen is far far from not blocking any real email, they regularly block large ISPs that refuse too indiscriminately drop customers on their request.
  - DanBC 11y ago
    From your link: > Update: Spamhaus has now commented on the case in a blog post, explaining how Cyberbunker (also known as CB3ROB) has been involved in hosting malware and phishing sites. Ironically, this very week Spamhaus has been working with the Dutch hi-tech crime unit to investigate the criminal activity hosted by Cyberbunker and routed by A2B. This is really your example of false positive blocking?
    - ryanlol 11y ago
      A2B was routing CB, CB was not using A2Bs IP space. Spam was not coming from A2B. A2Bs IP space was blocked by Spamhaus to force them to drop CB. What exactly justified blocking A2Bs IP space here? Spamhaus is a really shady organization with a history of unethical behavior, look up the nic.at fiasco as another example... Or just ask anyone who works in hosting.
      - DanBC 11y ago
        > Per Spamhaus policy, on October 6th, after notifying A2B several times since June without results, an SBL listing which A2B had been ignoring was escalated to the SBL's "providing a spam support service" category and increased to include one of A2B's IP ranges. The escalated SBL record SBL112638 listed 178.249.152.0/21 for providing routing "knowingly and for profit" to a rogue host known as "CB3ROB" or "Cyberbunker", an outfit which Spamhaus has long seen involved in hosting cybercrime and spam outfits. SBL listings of CB3ROB had been mounting steadily during 2011 for hosting malware, phishing and websites selling fraudulent goods advertised via spam. CB3ROB had announced that it would not terminate customers due to spam listings - an announcement which sent a golden invitation to even more spam and crime customers to the point where all of CB3ROB was placed on the Spamhaus DROP ("Don't Route Or Peer") list at the beginning of October. That's exactly what people want from something like the SBL, which is why it's used by so many people. Your reference to nic.at is weird - again they were providing services to a bunch of criminals. When complaining about false positives it'd be really helpful if you could point to people who aren't fucking scumbags who are getting blocked.